The Cost of Human Error in Cybersecurity
We can always count on people making mistakes. While most of our mistakes do not significantly affect our lives, some, even minor, everyday errors can have significant consequences. Making an occasional mistake is acceptable; the key is to make sure that those errors remain occasional and do not become routine.
Human error continues to be one of the leading causes of data breaches. According to the 2024 Verizon Data Breach Investigations Report, 68% of breaches involved a human element, such as phishing, password mismanagement, or misconfigured security settings. End-users account for 87% of these errors. Phishing and pretexting via email remain the primary causes of social engineering incidents, responsible for 73% of breaches.
Small and midsize businesses (SMBs) are especially vulnerable to cybersecurity attacks. They are attractive targets because of their weaker defenses, limited resources, and overstretched IT teams, which can create security gaps. However, many SMB employees mistakenly believe that cyberattacks primarily target large organizations with valuable data, leading to a lack of cybersecurity awareness.
The Power of Deliberate Practice in Cybersecurity Training
Psychologist Anders Ericsson’s deliberate practice theory, made popular by Malcolm Gladwell as the “10,000-hour rule,” suggests that expertise is achieved through “deliberate practice” — repeated, intentional, and structured practice focused on specific goals. This approach is common among athletes, musicians, and various other highly skilled professionals to enhance their performance. Unlike Gladwell’s catchy term, the deliberate practice theory does not define a specific number of hours required to master a skill. Instead, Ericsson emphasizes that the quality of practice is as crucial for skill development.
The same principle applies to cybersecurity awareness. Simply informing employees about cyber threats is not enough. Without practice, even knowledgeable individuals can fall victim to social engineering tactics.
For example, a friend recently received a verification code on a popular messaging app. Moments later, he got an urgent message from someone he knew, claiming to be locked out of their account and asking him to forward the code. Wanting to help, he complied immediately—only to realize a split second too late that it might be a scam. Within minutes, his account was compromised. Despite understanding cybersecurity risks, he fell for the deception in the moment.
To prevent such mistakes, employees must regularly engage in real-world attack simulations. Instead of passively learning about risks, employees actively identify and respond to threats in controlled environments, reinforcing their decision-making skills under pressure and building instinctive, security-conscious habits.
This proactive approach to cybersecurity is at the core of Security Awareness Training (SAT), empowering employees with the skills needed to recognize and respond to evolving threats.
The Most Effective SAT Features on the Market
Phishing simulations – A library of phishing simulations designed to evaluate an organization’s vulnerability to phishing attacks and raise employee awareness of the latest threats. The library includes pre-built templates and custom simulations to create realistic attack scenarios and track results.
Training courses – These courses feature curated training content and automated learning journeys that include engaging, trackable, concise video-based courses and interactive quizzes that educate employees on cybersecurity best practices. Custom settings allow companies to adjust the pace, content style, or delivery frequency to match their unique needs.
Adaptive training—This type of training leverages visibility into a company’s security posture using existing security tools. It addresses security gaps and promotes continuous learning by automatically adjusting highly targeted training content based on actual security exposures and user behavior.
Analytics—The SAT-related reports deliver powerful analytics to pinpoint vulnerabilities after phishing simulations. These reports track simulation engagement, phishing failure rates, and training completion rates. They include dashboards and executive summaries that provide compelling evidence of an organization’s cybersecurity and compliance training progress.
User Feedback—Email users can give feedback and easily report suspicious and potentially malicious emails directly from their inbox.
Scheduled Training—Administrators can schedule the frequency and assign recipients of automated training and campaigns that seamlessly deliver the right content to the right people at the right time.
Conclusion
Automated cybersecurity solutions are crucial for defending against attacks, but they cannot completely eliminate human error.
Investing in cybersecurity awareness is not optional—it is a necessity for SMBs. By providing employees with the training and knowledge to recognize phishing and social engineering attacks, businesses can strengthen their security posture, significantly reduce human error, and stay ahead of evolving threats.
